CVE-2026-92125

Jenkins Script Security Plugin versions 1415.v9a_f9b_3a_c253d and earlier fail to reject the @GroovyASTTransformationClass annotation, which allows an attacker with permission to define and run sandboxed scripts (including Pipelines) to trigger an arbitrary AST transformation at compile time . Th...

EUVD-2026-80749

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject the @GroovyASTTransformationClass annotation, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to run an arbitrary AST transformation at compile time, bypassing the sandbox...